The 30-Minute Agent Skill Review Kit
A fast checklist for deciding whether an AI-agent skill is safe to install, publish, buy, or delegate — with scoring, a permission matrix, and a copy/paste verdict template.
Use this when a skill is about to cross a trust boundary
Reusable agent skills are becoming software packages. The risky part is not the prompt text. The risky part is the authority the skill gets once it runs inside an agent with tools, memory, browser access, SaaS APIs, files, or delegated subagents.
Safe enough to run as-is.
Safe only with reduced permissions, draft-only mode, or human approval gates.
Promising, but missing operating-contract fields.
Unclear authority, unsafe data handling, no receipts, or no rollback path.
The 5-minute triage
| Question | Green flag | Red flag |
|---|---|---|
| What job does the skill do? | One clear job and explicit non-goals. | Vague “do everything” assistant behavior. |
| What can it touch? | Listed tools, actions, write permissions, and forbidden actions. | Hidden or broad tool authority. |
| What data can it see? | Required inputs and forbidden inputs are named. | Secrets, customer data, private files, or credentials are not addressed. |
| What proof does it produce? | Receipts with sources, decisions, writes, exceptions, and rollback notes. | “Trust me” output with no audit trail. |
| What happens when unsure? | Stop/draft/escalate rules. | Guessing, silent overwrite, or autonomous external action. |
The 10 trust-boundary checks
Score each area 0–2. A missing or unsafe field is 0; partial/ambiguous is 1; clear and operationally usable is 2.
Identity and scope
One job-to-be-done, non-goals, intended runner/runtime assumptions.
Input contract
Required inputs, forbidden inputs, private-data boundaries, freshness rules.
Tool authority
Allowed tools/actions, forbidden actions, approval gates for spend, destructive operations, posting, outbound, and production writes.
Memory policy
Read/propose/write/promote/expire/never-store rules. No silent long-term memory changes.
Output contract
Artifact/schema, done criteria, confidence, assumptions, and evidence requirements.
Receipts
Inputs, sources, decisions, tool actions, writes, exceptions, final artifact, and sensitive-data redaction.
Exception behavior
Low confidence, conflicts, missing input, tool failure, private data, high-stakes action.
Rollback and repair
Reversible vs compensatable vs irreversible actions, before/after state, rollback owner.
Eval contract
Happy path, missing input, stale/conflicting source, prompt injection, tool failure, rollback.
Portability
No hidden local assumptions. Runtime-specific behavior is named.
The permission matrix
Fill this before installation. Permission without receipt is not production-ready permission.
| Capability | Allowed? | Approval? | Receipt? | Notes |
|---|---|---|---|---|
| Read local files | Yes / No | Yes / No | Yes / No | Paths / boundaries |
| Write local files | Yes / No | Yes / No | Yes / No | Prefer draft folder first |
| Browser navigation | Yes / No | Yes / No | Yes / No | Allowed domains |
| SaaS/API writes | Yes / No | Yes / No | Yes / No | Fields/actions |
| Send messages/emails | Yes / No | Yes / No | Yes / No | Draft-first unless warm/authorized |
| Public posting | Yes / No | Yes / No | Yes / No | Channel rules |
| Spend money | Yes / No | Always | Yes | Default: no spend |
| Long-term memory writes | Yes / No | Yes / No | Yes | Promotion/expiry rules |
Copy/paste verdict template
# Agent Skill Review Verdict Skill name: Version / source: Reviewer: Date: ## Verdict - [ ] Install - [ ] Install with limits - [ ] Ask for changes - [ ] Reject / do not run ## Score Total: __ / 40 ## Top risks 1. 2. 3. ## Required fixes before wider use 1. 2. 3. ## Allowed mode - [ ] Read-only - [ ] Draft-only - [ ] Human-approved writes - [ ] Limited autonomous writes - [ ] Full autonomous run ## Required receipts - Sources: - Tool actions: - Writes: - Exceptions: - Rollback notes: ## Launch recommendation [One paragraph explaining why the skill is safe enough, limited, blocked, or rejected.]
What to fix first
- Narrow tool authority. Remove broad permissions. Start read-only or draft-only.
- Add receipts. Every run should leave enough evidence for a human or supervising agent to audit it.
- Define exception behavior. The skill must know when to stop instead of guessing.
Next step
If the skill touches real tools, customer data, memory, SaaS writes, external users, finance, or production systems, get a second-pass launch verdict.